DittoETH

Ditto
DeFiFoundryOracle
55,000 USDC
View results
Submission Details
Severity: low
Invalid

`VaultFaucet.sol` functions need to return a bool

Summary

The 4 functions of VaultFaucet.sol represent methods for depositing or withdrawing ERC20 tokens. All of them are not returning a boolean value indicating the success of the transaction.

Vulnerability Details

Returning a boolean value when moving ERC20 token is an industry standard, expected by developers when coding contracts that interact with one another. It helps in transaction verification, frontend interaction and error handling.

Impact

Don't be like USDT, return a boolean to comply with the ERC20 token standard, even if this contract VaultFaucet.sol is not an ERC20 implementation per se, it still moves ERC20 tokens.

Tools Used

Manual review

Recommendations

-- function depositZETH(address zeth, uint88 amount) external nonReentrant {
++ function depositZETH(address zeth, uint88 amount) external nonReentrant returns (bool) {
if (amount == 0) revert Errors.PriceOrAmountIs0();
uint256 vault;
if (zeth == carbonZeth) {
vault = Vault.CARBON;
} else {
if (s.zethVault[zeth] == 0) revert Errors.InvalidZeth();
vault = s.zethVault[zeth];
}
IERC20(zeth).burnFrom(msg.sender, amount);
s.vaultUser[vault][msg.sender].ethEscrowed += amount;
++ return true;
}
function depositAsset(address asset, uint104 amount)
external
onlyValidAsset(asset)
isNotFrozen(asset)
nonReentrant
++ returns (bool)
{
if (amount == 0) revert Errors.PriceOrAmountIs0();
IERC20(asset).burnFrom(msg.sender, amount);
s.assetUser[asset][msg.sender].ercEscrowed += amount;
++ return true;
}
-- function withdrawZETH(address zeth, uint88 amount) external nonReentrant {
++ function withdrawZETH(address zeth, uint88 amount) external nonReentrant returns (bool) {
if (amount == 0) revert Errors.PriceOrAmountIs0();
uint256 vault;
if (zeth == carbonZeth) {
vault = Vault.CARBON;
} else {
if (s.zethVault[zeth] == 0) revert Errors.InvalidZeth();
vault = s.zethVault[zeth];
}
STypes.VaultUser storage VaultUser = s.vaultUser[vault][msg.sender];
if (amount > VaultUser.ethEscrowed) revert Errors.InsufficientETHEscrowed();
VaultUser.ethEscrowed -= amount;
IERC20(zeth).mint(msg.sender, amount);
++ return true;
}
function withdrawAsset(address asset, uint104 amount)
external
onlyValidAsset(asset)
nonReentrant
++ returns (bool)
{
if (amount == 0) revert Errors.PriceOrAmountIs0();
STypes.AssetUser storage AssetUser = s.assetUser[asset][msg.sender];
if (amount > AssetUser.ercEscrowed) revert Errors.InsufficientERCEscrowed();
AssetUser.ercEscrowed -= amount;
IERC20(asset).mint(msg.sender, amount);
++ return true;
}
Updates

Lead Judging Commences

0xnevi Lead Judge
almost 2 years ago
0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: EIP compliance with no integrations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.